sharp - npm Package Compare versions

Comparing version 0.30.4 to 0.30.5

install/libvips.js

@@ -38,2 +38,3 @@ 'use strict';
 const { minimumLibvipsVersion, minimumLibvipsVersionLabelled } = libvips;
+const localLibvipsDir = process.env.npm_config_sharp_libvips_local_prebuilds || '';
 const distHost = process.env.npm_config_sharp_libvips_binary_host || 'https://github.com/lovell/sharp-libvips/releases/download';
@@ -46,3 +47,5 @@ const distBaseUrl = process.env.npm_config_sharp_dist_base_url || process.env.SHARP_DIST_BASE_URL || `${distHost}/v${minimumLibvipsVersionLabelled}/`;
   if (err.code === 'EACCES') {
-    libvips.log('Are you trying to install as a root or sudo user? Try again with the --unsafe-perm flag');
+    libvips.log('Are you trying to install as a root or sudo user?');
+    libvips.log('- For npm <= v6, try again with the "--unsafe-perm" flag');
+    libvips.log('- For npm >= v8, the user must own the directory "npm install" is run in');
   }
@@ -161,2 +164,7 @@ libvips.log('Please see https://sharp.pixelplumbing.com/install for required dependencies');
       extractTarball(tarPathCache, platformAndArch);
+    } else if (localLibvipsDir) {
+      // If localLibvipsDir is given try to use binaries from local directory
+      const tarPathLocal = path.join(path.resolve(localLibvipsDir), `v${minimumLibvipsVersionLabelled}`, tarFilename);
+      libvips.log(`Using local libvips from ${tarPathLocal}`);
+      extractTarball(tarPathLocal, platformAndArch);
     } else {
@@ -163,0 +171,0 @@ const url = distBaseUrl + tarFilename;

lib/composite.js

@@ -53,3 +53,3 @@ 'use strict';
  * More information about blend modes can be found at
- * https://libvips.github.io/libvips/API/current/libvips-conversion.html#VipsBlendMode
+ * https://www.libvips.org/API/current/libvips-conversion.html#VipsBlendMode
  * and https://www.cairographics.org/operators/
@@ -56,0 +56,0 @@ *

lib/input.js

@@ -312,5 +312,5 @@ 'use strict';
  * - `height`: Number of pixels high (EXIF orientation is not taken into consideration, see example below)
- * - `space`: Name of colour space interpretation e.g. `srgb`, `rgb`, `cmyk`, `lab`, `b-w` [...](https://libvips.github.io/libvips/API/current/VipsImage.html#VipsInterpretation)
+ * - `space`: Name of colour space interpretation e.g. `srgb`, `rgb`, `cmyk`, `lab`, `b-w` [...](https://www.libvips.org/API/current/VipsImage.html#VipsInterpretation)
  * - `channels`: Number of bands e.g. `3` for sRGB, `4` for CMYK
- * - `depth`: Name of pixel depth format e.g. `uchar`, `char`, `ushort`, `float` [...](https://libvips.github.io/libvips/API/current/VipsImage.html#VipsBandFormat)
+ * - `depth`: Name of pixel depth format e.g. `uchar`, `char`, `ushort`, `float` [...](https://www.libvips.org/API/current/VipsImage.html#VipsBandFormat)
  * - `density`: Number of pixels per inch (DPI), if present
@@ -317,0 +317,0 @@ * - `chromaSubsampling`: String containing JPEG chroma subsampling, `4:2:0` or `4:4:4` for RGB, `4:2:0:4` or `4:4:4:4` for CMYK

lib/libvips.js

@@ -68,3 +68,8 @@ 'use strict';
   if (process.platform !== 'win32') {
-    const globalLibvipsVersion = spawnSync(`PKG_CONFIG_PATH="${pkgConfigPath()}" pkg-config --modversion vips-cpp`, spawnSyncOptions).stdout;
+    const globalLibvipsVersion = spawnSync('pkg-config --modversion vips-cpp', {
+      ...spawnSyncOptions,
+      env: {
+        PKG_CONFIG_PATH: pkgConfigPath()
+      }
+    }).stdout;
     /* istanbul ignore next */
@@ -89,3 +94,6 @@ return (globalLibvipsVersion || '').trim();
   if (process.platform !== 'win32') {
-    const brewPkgConfigPath = spawnSync('which brew >/dev/null 2>&1 && eval $(brew --env) && echo $PKG_CONFIG_LIBDIR', spawnSyncOptions).stdout || '';
+    const brewPkgConfigPath = spawnSync(
+      'which brew >/dev/null 2>&1 && brew environment --plain | grep PKG_CONFIG_LIBDIR | cut -d" " -f2',
+      spawnSyncOptions
+    ).stdout || '';
     return [
@@ -92,0 +100,0 @@ brewPkgConfigPath.trim(),

lib/output.js

@@ -85,2 +85,4 @@ 'use strict';
  *
+ * Use {@link toFormat} or one of the format-specific functions such as {@link jpeg}, {@link png} etc. to set the output format.
+ *
  * If no explicit format is set, the output format will match the input image, except SVG input which becomes PNG output.
@@ -112,2 +114,3 @@ *
  * sharp(input)
+ *   .png()
  *   .toBuffer({ resolveWithObject: true })
@@ -521,3 +524,3 @@ *   .then(({ data, info }) => { ... })
  *   .gif()
- *   .toBuffer());
+ *   .toBuffer();
  *
@@ -524,0 +527,0 @@ * @example

lib/platform.js

@@ -10,6 +10,8 @@ 'use strict';
   const platform = env.npm_config_platform || process.platform;
-  /* istanbul ignore next */
-  const libc = (platform === 'linux' && detectLibc.isNonGlibcLinuxSync()) ? detectLibc.familySync() : '';
+  const libc = process.env.npm_config_libc ||
+    /* istanbul ignore next */
+    (detectLibc.isNonGlibcLinuxSync() ? detectLibc.familySync() : '');
+  const libcId = platform !== 'linux' || libc === detectLibc.GLIBC ? '' : libc;
 
-  const platformId = [`${platform}${libc}`];
+  const platformId = [`${platform}${libcId}`];
 
@@ -16,0 +18,0 @@ if (arch === 'arm') {

lib/sharp.js

@@ -16,3 +16,3 @@ 'use strict';
     help.push(
-      '- Install with the --verbose flag and look for errors: "npm install --ignore-scripts=false --verbose sharp"',
+      '- Install with verbose logging and look for errors: "npm install --ignore-scripts=false --foreground-scripts --verbose sharp"',
       `- Install for the current ${platformAndArch} runtime: "npm install --platform=${platform} --arch=${arch} sharp"`
@@ -19,0 +19,0 @@ );

lib/utility.js

@@ -106,4 +106,8 @@ 'use strict';
  * Gets or, when a concurrency is provided, sets
- * the number of threads _libvips'_ should create to process each image.
+ * the maximum number of threads _libvips_ should use to process _each image_.
+ * These are from a thread pool managed by glib,
+ * which helps avoid the overhead of creating new threads.
  *
+ * This method always returns the current concurrency.
+ *
  * The default value is the number of CPU cores,
@@ -115,7 +119,16 @@ * except when using glibc-based Linux without jemalloc,
  *
- * The maximum number of images that can be processed in parallel
- * is limited by libuv's `UV_THREADPOOL_SIZE` environment variable.
+ * Some image format libraries spawn additional threads,
+ * e.g. libaom manages its own 4 threads when encoding AVIF images,
+ * and these are independent of the value set here.
  *
- * This method always returns the current concurrency.
+ * The maximum number of images that sharp can process in parallel
+ * is controlled by libuv's `UV_THREADPOOL_SIZE` environment variable,
+ * which defaults to 4.
  *
+ * https://nodejs.org/api/cli.html#uv_threadpool_sizesize
+ *
+ * For example, by default, a machine with 8 CPU cores will process
+ * 4 images in parallel and use up to 8 threads per image,
+ * so there will be up to 32 concurrent threads.
+ *
  * @example
@@ -122,0 +135,0 @@ * const threads = sharp.concurrency(); // 4

package.json

 {
   "name": "sharp",
   "description": "High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images",
-  "version": "0.30.4",
+  "version": "0.30.5",
   "author": "Lovell Fuller <[e-mail]>",
@@ -85,3 +85,4 @@ "homepage": "https://github.com/lovell/sharp",
     "Ompal Singh <[e-mail]>",
-    "Brodan <[e-mail]"
+    "Brodan <[e-mail]",
+    "Ankur Parihar <[e-mail]>"
   ],
@@ -133,4 +134,4 @@ "scripts": {
     "detect-libc": "^2.0.1",
-    "node-addon-api": "^4.3.0",
-    "prebuild-install": "^7.0.1",
+    "node-addon-api": "^5.0.0",
+    "prebuild-install": "^7.1.0",
     "semver": "^7.3.7",
@@ -149,3 +150,3 @@ "simple-get": "^4.0.1",
     "license-checker": "^25.0.1",
-    "mocha": "^9.2.2",
+    "mocha": "^10.0.0",
     "mock-fs": "^5.1.2",
@@ -152,0 +153,0 @@ "nyc": "^15.1.0",

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Improved metrics

Total package byte prevSize

492954

increased by0.31%

Lines of code

4628

increased by0.74%

Worsened metrics

Number of low supply chain risk alerts

19

increased by11.76%

Dependency changes

• + Addednode-addon-api@5.1.0(transitive)

• - Removednode-addon-api@4.3.0(transitive)

• Updatednode-addon-api@^5.0.0

• Updatedprebuild-install@^7.1.0